diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 76eef83..2051807 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   statics:
     name: Static checks
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..af56f61
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+.DS_Store
+.idea/
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 81ba5fc..c148cf5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -20,3 +20,10 @@ repos:
           - "4"
           - "--title"
           - "**Table of Contents**"
+-   repo: local
+    hooks:
+    -   id: no-input-eval
+        name: Inputs must be compared, not executed
+        language: pygrep
+        entry: '(if|elif|while|until) +"?\$\{?INPUT_'
+        files: ^start\.sh$
diff --git a/start.sh b/start.sh
index bbf37f9..5084076 100755
--- a/start.sh
+++ b/start.sh
@@ -22,11 +22,11 @@ echo "Synchronizing repository ${TARGET_REPOSITORY}:${INPUT_TARGET_BRANCH} with
     exit 1;
 };
 
-if ${INPUT_FORCE}; then
+if [ "${INPUT_FORCE}" = "true" ]; then
     _FORCE_OPTION='--force'
 fi
 
-if ${INPUT_TAGS}; then
+if [ "${INPUT_TAGS}" = "true" ]; then
     _TAGS='--follow-tags --tags'
 fi